Covert timing channels are a mechanism by which secret or confidential information can be coded in the output of computer software. For example, a covert timing channel can encode secret information in the timing between messages output by a computer program. In one example of a covert timing channel, messages that are close in time to each other may indicate a binary 1 and the absence of messages for a predetermined time period may indicate a binary 0.
Some existing methods for detecting covert timing channels search for patterns in software output to detect the presence of a covert timing channel. However, because such patterns are easily changeable, covert pattern detection methods must also change as new covert timing channel patterns emerge. As a result, pattern based covert timing channel detectors must be periodically updated as new covert timing channel patterns are discovered. This cycle of discovering new patterns and updating covert timing channel pattern detection software is undesirable as pattern detectors will always be behind new covert timing pattern generators.
Accordingly, there exists a need for improved, methods, systems, and computer readable media for detecting covert timing channels.